fix(xpeng): IMAP-Poller Blocker-Fixes - robusteres Download + Retry-Logik

- Passwort-Regex: Doppelpunkt zwingend, "Code:" ergaenzt, kein False-Positive fuer "password will be sent"
- Body-Fallback: nur kurze, leerraumfreie Strings (4-60 Zeichen)
- HTML-Entities in Download-Links werden unescaped (& -> &)
- downloadToTempFile: HTTP-Status wird geprueft (non-200 wirft sofort Exception)
- downloadToTempFile: Groessenlimit wird streaming-inline erzwungen, kein post-hoc
- processDownloadLinks: bei Fehler kein xpeng_received_mail-Record, Mail bleibt UNSEEN fuer Retry

Author: sebastianwien

backend/src/main/java/com/evmonitor/application/imports/xpeng/XpengImapPoller.java

@@ -45,7 +45,7 @@ public class XpengImapPoller {
                     Pattern.CASE_INSENSITIVE);
 
     private static final Pattern PASSWORD_PATTERN =
-            Pattern.compile("(?:password|passwort|pw)[:\\s]+([\\S]{4,30})",
+            Pattern.compile("(?:password|passwort|pw|code)\\s*:\\s*([\\S]{4,30})",
                     Pattern.CASE_INSENSITIVE);
 
     private static final Pattern DOWNLOAD_LINK_PATTERN =
@@ -220,6 +220,7 @@ private void processDownloadLinks(Message msg, XpengConnection conn, String mess
         log.info("XPeng IMAP: {} Download-Link(s) in Mail von '{}' gefunden", downloadLinks.size(), from);
 
         String password = lookupStoredPassword(conn.getId());
+        boolean allSucceeded = true;
 
         for (String url : downloadLinks) {
             String filename = extractFilenameFromLinkContext(htmlBody, url);
@@ -238,16 +239,20 @@ private void processDownloadLinks(Message msg, XpengConnection conn, String mess
                             job.getId(), conn.getId(), filename);
                 }
             } catch (Exception e) {
-                log.error("XPeng IMAP: Download-Fehler fuer URL '{}': {}", url, e.getMessage(), e);
-                saveReceivedMailRecord(conn.getId(), messageId, filename, null, null);
+                log.error("XPeng IMAP: Download-Fehler fuer URL '{}' - Mail bleibt ungelesen fuer Retry: {}", url, e.getMessage(), e);
+                allSucceeded = false;
             } finally {
                 if (tmp != null) {
                     try { Files.deleteIfExists(tmp); } catch (Exception ignored) {}
                 }
             }
         }
 
-        msg.setFlag(Flags.Flag.SEEN, true);
+        if (allSucceeded) {
+            msg.setFlag(Flags.Flag.SEEN, true);
+        } else {
+            log.warn("XPeng IMAP: Mindestens ein Download fehlgeschlagen - Mail bleibt UNSEEN, naechster Poll versucht es erneut");
+        }
     }
 
     private String lookupStoredPassword(UUID connectionId) {
@@ -265,15 +270,27 @@ private Path downloadToTempFile(String url) throws Exception {
         HttpRequest request = HttpRequest.newBuilder()
                 .uri(URI.create(url))
                 .timeout(Duration.ofSeconds(60))
+                .header("User-Agent", "EV-Monitor-XPeng-Importer/1.0")
                 .GET()
                 .build();
         Path tmp = Files.createTempFile("xpeng-download-", ".xlsx");
         HttpResponse<InputStream> response = client.send(request, HttpResponse.BodyHandlers.ofInputStream());
-        try (InputStream body = response.body()) {
-            long copied = Files.copy(body, tmp, StandardCopyOption.REPLACE_EXISTING);
-            if (copied > MAX_DOWNLOAD_BYTES) {
-                Files.deleteIfExists(tmp);
-                throw new IllegalStateException("Download zu gross: " + copied + " Bytes (max " + MAX_DOWNLOAD_BYTES + ")");
+        if (response.statusCode() != 200) {
+            Files.deleteIfExists(tmp);
+            throw new IllegalStateException("Download fehlgeschlagen: HTTP " + response.statusCode() + " fuer " + url);
+        }
+        try (InputStream body = response.body();
+             var out = Files.newOutputStream(tmp)) {
+            byte[] buf = new byte[65536];
+            long total = 0;
+            int n;
+            while ((n = body.read(buf)) > 0) {
+                total += n;
+                if (total > MAX_DOWNLOAD_BYTES) {
+                    Files.deleteIfExists(tmp);
+                    throw new IllegalStateException("Download zu gross: >" + MAX_DOWNLOAD_BYTES + " Bytes");
+                }
+                out.write(buf, 0, n);
             }
         }
         return tmp;
@@ -295,7 +312,7 @@ static List<String> extractXpengDownloadLinks(String html) {
         List<String> links = new ArrayList<>();
         Matcher m = DOWNLOAD_LINK_PATTERN.matcher(html);
         while (m.find()) {
-            links.add(m.group(1));
+            links.add(m.group(1).replace("&amp;", "&").replace("&lt;", "<").replace("&gt;", ">"));
         }
         return links;
     }
@@ -365,7 +382,8 @@ static String extractPassword(String body, String vinSuffix) {
             Matcher vm = vinPattern.matcher(trimmed);
             if (vm.find()) return vm.group(1);
         }
-        return trimmed.length() < 200 && !trimmed.isEmpty() ? trimmed : null;
+        // Fallback: kurzer Body ohne Leerzeichen = wahrscheinlich reines Passwort-Token
+        return trimmed.length() >= 4 && trimmed.length() <= 60 && !trimmed.contains(" ") ? trimmed : null;
     }
 
     private static String getPlainTextBody(Message msg) {

backend/src/test/java/com/evmonitor/application/imports/xpeng/XpengImapPollerTest.java

@@ -200,6 +200,32 @@ void keywordMatchTakesPriorityOverVinSuffix() {
                 "Password: MyPass - also 202512237070 here", "7070"));
     }
 
+    // Blocker 3a: "Code:" Keyword (echtes XPeng-Format)
+    @Test
+    void extractsCodeKeywordAsPassword() {
+        assertEquals("202605287070", XpengImapPoller.extractPassword("Code: 202605287070", null));
+    }
+
+    // Blocker 3b: "password will be sent" darf NICHT matchen
+    @Test
+    void doesNotExtractPasswordFromPasswordWillPhrase() {
+        String body = "The password will be sent to you in a separate email.";
+        assertNull(XpengImapPoller.extractPassword(body, null));
+    }
+
+    // Blocker 3c: Body-Fallback darf nicht bei Sätzen (Leerzeichen) triggern
+    @Test
+    void bodyFallbackIgnoresTextWithSpaces() {
+        String body = "Dear customer";
+        assertNull(XpengImapPoller.extractPassword(body, null));
+    }
+
+    // Blocker 3d: Body-Fallback greift bei tokenartigem Kurztext ohne Leerzeichen
+    @Test
+    void bodyFallbackWorksForTokenWithoutSpaces() {
+        assertEquals("Abc12345", XpengImapPoller.extractPassword("Abc12345", null));
+    }
+
     // --- processMessage: password extracted from nested multipart ---
 
     @Test
@@ -357,6 +383,19 @@ void returnsEmptyListForNullHtml() {
         assertTrue(links.isEmpty());
     }
 
+    // Blocker 5: & in href-Attributen wird zu & unescaped
+    @Test
+    void unescapesHtmlEntitiesInDownloadLink() {
+        String url = "https://mail.xiaopeng.com/alimail/openLinks/downloadMimeMetaDiskBigAttach?id=abc&foo=bar";
+        String html = "<a href=\"" + url + "\">下载</a>";
+
+        List<String> links = XpengImapPoller.extractXpengDownloadLinks(html);
+
+        assertEquals(1, links.size());
+        assertEquals("https://mail.xiaopeng.com/alimail/openLinks/downloadMimeMetaDiskBigAttach?id=abc&foo=bar",
+                links.get(0));
+    }
+
     @Test
     void extractsMultipleDownloadLinks() {
         String html = "<html><body>"
@@ -416,6 +455,29 @@ private List<String> getImapFolders() {
         return (List<String>) ReflectionTestUtils.getField(poller, "imapFolders");
     }
 
+    // --- Fix 4: Download-Fehler = kein Record + kein SEEN (Retry) ---
+
+    @Test
+    void doesNotSaveRecordOrMarkSeenWhenDownloadFails() throws Exception {
+        UUID token = UUID.randomUUID();
+        String html = "<a href=\"https://mail.xiaopeng.com/alimail/openLinks/downloadMimeMetaDiskBigAttach?id=unreachable\">下载</a>";
+        Message msg = mockMessage("<dl-fail@test.com>", "Re: XPeng [token:" + token + "]");
+        // No XLSX attachment (isMimeType multipart/* false), HTML body with download link
+        lenient().when(msg.isMimeType("multipart/*")).thenReturn(false);
+        lenient().when(msg.isMimeType("text/html")).thenReturn(true);
+        lenient().when(msg.getContent()).thenReturn(html);
+        when(msg.getFrom()).thenReturn(new jakarta.mail.Address[]{});
+        XpengConnection conn = buildConn(token, false);
+        when(receivedMailRepo.existsByMessageId(any())).thenReturn(false);
+        when(connectionRepo.findByRoutingToken(token)).thenReturn(Optional.of(conn));
+
+        // downloadToTempFile will throw (unreachable host) → allSucceeded = false
+        invokeProcessMessage(msg);
+
+        verify(receivedMailRepo, never()).save(any());
+        verify(msg, never()).setFlag(Flags.Flag.SEEN, true);
+    }
+
     // --- helpers ---
 
     private static Message mockMessage(String messageId, String subject) throws Exception {